“We’re told constantly that it’s a secure system and it’s not, obviously,” Dougall said. He explained when he contacted representatives for HealthCare.gov, operators had no procedure on how to handle security breaches.